Fake login pages and portals built to capture passwords, MFA codes, or session cookies.
View All Tags
The tax inspection of your company has revealed irregularities under Section 271(1)(c) of the Income Tax Act, 1961. The same forged Income Tax Department notice we dissected a month ago, rewritten to remove its worst mistakes and pointed at a convincing lookalike domain registered in Indonesia.
We are contacting you regarding your expired domain registration. A WordPress.com-branded final warning sent from a German mail server subdomain, whose only button points at a throwaway subdomain of an Italian sports academy.
You have Two (2) Messages Pending Delivery on Your E-mail Portal. A notice claiming to be your own domain's web administrator, sent from an animal-feed company's accounts mailbox, whose button opens a page the attacker uploaded into a Google Cloud Storage bucket.
Your payment has been successfully processed. Please find the attached SWIFT advice and supporting documentation for your records. Four lines of flawless business English, a Re: subject line for a conversation that never happened, and a 140 KB PDF that is the entire attack.
We couldn't renew your Cloud storage subscription because your payment method needs to be updated. A storage-full warning whose body is actually about a failed payment, sent from a domain on a top-level domain that does not exist, linking to a page parked inside a Google Cloud Storage bucket.
We are reaching out to inform you that your domain registration with WordPress.com is approaching its expiration date and requires renewal to maintain active status. A pixel-perfect WordPress.com notice sent from an Italian postmaster mailbox, whose only button points at a German health domain.
Judicial Notice. Case Matter: Tax Dispute / Financeira. Investigating Authority: Renda Tax Department, Government of India. A summons from a tax authority that does not exist, sent from a free Outlook mailbox, still carrying the Portuguese words of the template it was copied from.
Your bank account will be charged $3,520.00. A fake QuickBooks debit alert whose visible Intuit link actually routes through a hijacked mobile-marketing redirect to an attacker-controlled site.
Your document is ready for review. A counterfeit DocuSign notification whose "Review & Sign" button leads to a CDN-hosted credential harvesting page with your own address baked into the link.
Dear Support. You have a fax document from Xerox Scanner. Pages: 2 Full scanned PDF/HTML File. Remote ID: 34455191. Priority Notice - Review Doc_Xerox File Shared
